SOC/IR Evidence Pipeline

TealTiger’s SOC/IR pipeline delivers governance evidence to security operations teams in the formats they already use — JSON, CEF (Common Event Format), and LEEF (Log Event Extended Format) for SIEM ingestion, OpenTelemetry spans for distributed tracing, and response hooks with deduplication and rate limiting for automated incident response.

This pipeline addresses the “evidence gap” between AI governance and security operations. SOC teams need governance events in their existing SIEM workflows — not in a separate dashboard they’ll never check. TealTiger bridges this gap with native format support.

Why This Matters

Risk	Without SOC Integration	With SOC/IR Pipeline
Blind spots	AI governance events invisible to SOC	Governance events in SIEM alongside infrastructure alerts
Slow response	Governance violations discovered in post-mortem	Real-time alerts with automated response hooks
Alert fatigue	Duplicate alerts overwhelm analysts	Deduplication and rate limiting reduce noise
Correlation gaps	Cannot correlate AI events with infrastructure events	OpenTelemetry spans enable cross-system correlation
Format friction	Custom formats require parser development	Native CEF/LEEF/JSON — plug into existing pipelines

Compliance alignment: NIST CSF (DE.CM — continuous monitoring), SOC 2 CC7.2 (system monitoring), ISO 27001 A.12.4 (logging and monitoring).

SIEM Export Formats

JSON Format

Structured JSON events for Splunk, Elasticsearch, Datadog, and custom pipelines:

import { SIEMExporter } from 'tealtiger/soc';

const exporter = new SIEMExporter({
  format: 'json',
  destination: {
    type: 'http',
    url: 'https://splunk-hec.acme.com:8088/services/collector',
    headers: { 'Authorization': 'Splunk ${HEC_TOKEN}' }
  },
  enrichment: {
    environment: 'production',
    service: 'ai-governance',
    team: 'platform-security'
  }
});

JSON event structure:

{
  "timestamp": "2026-06-01T14:30:00.000Z",
  "event_type": "governance.denial",
  "severity": "high",
  "correlation_id": "req-abc-123",
  "agent_id": "support-bot-001",
  "action": "database.delete",
  "decision": "DENY",
  "reason_codes": ["FREEZE_PRODUCTION_DB_DELETE"],
  "automation_level": "auto_deny",
  "risk_score": 100,
  "drift_score": 0.0,
  "policy_version": "2.1.0",
  "engine_version": "1.3.0",
  "nhi": {
    "id": "agent-support-bot-001",
    "owner": "[email protected]",
    "state": "active",
    "attestation_valid": true
  },
  "evidence": {
    "receipt_id": "rcpt-xyz789",
    "merkle_root": "sha256:abc...",
    "tsa_timestamp": "2026-06-01T14:30:00.123Z"
  },
  "enrichment": {
    "environment": "production",
    "service": "ai-governance"
  }
}

CEF Format (Common Event Format)

For ArcSight, QRadar, and CEF-compatible SIEMs:

const exporter = new SIEMExporter({
  format: 'cef',
  destination: {
    type: 'syslog',
    host: 'siem.acme.com',
    port: 514,
    protocol: 'tcp-tls'
  }
});

CEF output:

CEF:0|TealTiger|GovernanceEngine|1.3.0|DENY|Governance Denial|9|
  src=agent-support-bot-001
  dst=database.delete
  act=DENY
  reason=FREEZE_PRODUCTION_DB_DELETE
  cs1=req-abc-123 cs1Label=CorrelationID
  cs2=2.1.0 cs2Label=PolicyVersion
  cn1=100 cn1Label=RiskScore
  rt=Jun 01 2026 14:30:00

LEEF Format (Log Event Extended Format)

For IBM QRadar:

const exporter = new SIEMExporter({
  format: 'leef',
  destination: {
    type: 'syslog',
    host: 'qradar.acme.com',
    port: 514,
    protocol: 'udp'
  }
});

LEEF output:

LEEF:2.0|TealTiger|GovernanceEngine|1.3.0|DENY|
  cat=AI Governance
  src=agent-support-bot-001
  dst=database.delete
  action=DENY
  reason=FREEZE_PRODUCTION_DB_DELETE
  correlationId=req-abc-123
  riskScore=100
  devTime=Jun 01 2026 14:30:00 UTC

OpenTelemetry Spans

TealTiger emits OpenTelemetry spans for every governance evaluation, enabling correlation with your existing distributed traces:

import { TealTigerOTelExporter } from 'tealtiger/soc';

const otelExporter = new TealTigerOTelExporter({
  endpoint: 'https://otel-collector.acme.com:4317',
  protocol: 'grpc',
  serviceName: 'tealtiger-governance',
  serviceVersion: '1.3.0'
});

Span Conventions

TealTiger follows OpenTelemetry semantic conventions with AI governance extensions:

Span: tealtiger.evaluate
├── Attributes:
│   ├── tealtiger.correlation_id: "req-abc-123"
│   ├── tealtiger.agent_id: "support-bot-001"
│   ├── tealtiger.action: "database.delete"
│   ├── tealtiger.decision: "DENY"
│   ├── tealtiger.automation_level: "auto_deny"
│   ├── tealtiger.risk_score: 100
│   ├── tealtiger.policy_version: "2.1.0"
│   ├── tealtiger.reason_codes: ["FREEZE_PRODUCTION_DB_DELETE"]
│   ├── tealtiger.drift_score: 0.0
│   └── tealtiger.evaluation_time_ms: 8
├── Events:
│   ├── tealtiger.freeze_triggered (timestamp, rule_id)
│   └── tealtiger.evidence_emitted (receipt_id)
└── Links:
    └── parent_trace_id (links to application trace)

Trace Correlation

TealTiger spans link to your application’s trace context, enabling end-to-end visibility:

// Application code
const span = tracer.startSpan('agent.execute');

// TealTiger automatically picks up the active trace context
const decision = await engine.evaluate(request, {
  correlation_id: span.spanContext().traceId,
  // ...
});

// In your SIEM/APM: application span → tealtiger.evaluate span → decision

Response Hooks

Response hooks enable automated incident response when governance events match specific criteria. They include built-in deduplication and rate limiting to prevent alert storms.

import { ResponseHookManager } from 'tealtiger/soc';

const hooks = new ResponseHookManager({
  dedup: {
    enabled: true,
    window: '5m',        // Deduplicate identical events within 5 minutes
    key: ['agent_id', 'action', 'decision']  // Dedup key fields
  },
  rateLimit: {
    enabled: true,
    maxPerMinute: 10,    // Max 10 hook invocations per minute
    maxPerHour: 100,     // Max 100 per hour
    burstAllowance: 5    // Allow burst of 5 before rate limiting
  }
});

// Register response hooks
hooks.register({
  name: 'freeze-violation-alert',
  trigger: { event_type: 'freeze.tamper_attempt' },
  actions: [
    { type: 'pagerduty', severity: 'critical', routingKey: process.env.PD_KEY },
    { type: 'slack', channel: '#security-critical', mention: '@security-oncall' },
    { type: 'webhook', url: 'https://soar.acme.com/api/incidents', method: 'POST' }
  ]
});

hooks.register({
  name: 'high-drift-alert',
  trigger: { drift_score: { gt: 0.8 } },
  actions: [
    { type: 'slack', channel: '#ai-governance', mention: '@ai-ops' },
    { type: 'suspend_agent', agentId: '$event.agent_id' }  // Auto-suspend
  ]
});

hooks.register({
  name: 'cost-anomaly-alert',
  trigger: { event_type: 'cost.anomaly', severity: 'high' },
  actions: [
    { type: 'email', to: '[email protected]', template: 'cost-anomaly' },
    { type: 'throttle_agent', agentId: '$event.agent_id', limit: '10req/min' }
  ]
});

Hook Actions

Action Type	Description
`pagerduty`	Create PagerDuty incident
`slack`	Send Slack message
`webhook`	HTTP POST to custom endpoint
`email`	Send email notification
`suspend_agent`	Suspend agent NHI (automated response)
`throttle_agent`	Apply rate limit to agent
`create_ticket`	Create Jira/ServiceNow ticket
`run_playbook`	Trigger SOAR playbook

Deduplication

Deduplication prevents the same event from triggering multiple alerts:

// First FREEZE violation from agent-001 → triggers alert
// Second identical violation within 5 minutes → deduplicated (no alert)
// Third violation after 5 minutes → triggers new alert

hooks.getDeduplicationStats();
// { totalEvents: 47, deduplicated: 31, delivered: 16 }

Rate Limiting

Rate limiting prevents alert storms during cascading failures:

// If 50 agents all trigger drift alerts simultaneously:
// First 10 → delivered (within per-minute limit)
// Next 40 → rate-limited (queued or dropped based on config)
// Summary alert sent: "40 additional drift alerts suppressed"

hooks.getRateLimitStats();
// { delivered: 10, rateLimited: 40, summaryAlertSent: true }

Full Pipeline Configuration

import { SOCPipeline } from 'tealtiger/soc';

const pipeline = new SOCPipeline({
  // SIEM export
  siem: {
    primary: { format: 'json', destination: { type: 'http', url: '...' } },
    secondary: { format: 'cef', destination: { type: 'syslog', host: '...' } }
  },

  // OpenTelemetry
  otel: {
    enabled: true,
    endpoint: 'https://otel-collector.acme.com:4317',
    serviceName: 'tealtiger-governance'
  },

  // Response hooks
  hooks: {
    dedup: { enabled: true, window: '5m' },
    rateLimit: { enabled: true, maxPerMinute: 10 },
    hooks: [/* ... */]
  },

  // Event filtering (what to export)
  filter: {
    minSeverity: 'medium',  // Don't export low-severity events
    includeTypes: ['denial', 'freeze', 'drift', 'anomaly', 'tamper'],
    excludeAgents: ['test-*']  // Exclude test agents
  }
});

// Attach to TealEngine
const engine = new TealEngine({
  policy: myPolicy,
  modules: [/* ... */],
  postHooks: [pipeline.asPostHook()]
});

TealEngine v1.3 API — Post-evaluation hooks
TealProof — Cryptographic evidence generation
FREEZE Rules — FREEZE_TAMPER_ATTEMPT events
TealDrift — Drift detection events
TealMonitor v2 — Cost anomaly events
OpenTelemetry Integration — Existing OTel docs

Getting Started

Core Concepts

Governance Domains

Policy Authoring

Architecture

Integrations

Deployment

API Reference

Cookbook

Compliance & GRC

Guides

Reference

Versions

Playground

Dashboard

Blog

Why This Matters

SIEM Export Formats

JSON Format

CEF Format (Common Event Format)

LEEF Format (Log Event Extended Format)

OpenTelemetry Spans

Span Conventions

Trace Correlation

Response Hooks

Hook Actions

Deduplication

Rate Limiting

Full Pipeline Configuration

​Why This Matters

​SIEM Export Formats

​JSON Format

​CEF Format (Common Event Format)

​LEEF Format (Log Event Extended Format)

​OpenTelemetry Spans

​Span Conventions

​Trace Correlation

​Response Hooks

​Hook Actions

​Deduplication

​Rate Limiting

​Full Pipeline Configuration

​Related Documentation

Why This Matters

SIEM Export Formats

JSON Format

CEF Format (Common Event Format)

LEEF Format (Log Event Extended Format)

OpenTelemetry Spans

Span Conventions

Trace Correlation

Response Hooks

Hook Actions

Deduplication

Rate Limiting

Full Pipeline Configuration

Related Documentation